DefaultCredentialsError if project in env but not credentials

We use a custom method to get credentials (we need to pass them in through env variables). I think that the library prevents us from using the GOOGLE_CLOUD_PROJECT env var - is that right?

Specifically: when initializing a client, the library attempts to find a default project (> /usr/local/lib/python2.7/dist-packages/google/cloud/_helpers.py(179)_determine_default_project()), and calls google.auth.default().

That function only uses explicit_project_id if it can find credentials:

    258     from google.auth.credentials import with_scopes_if_required
    259
    260     explicit_project_id = os.environ.get(
    261         environment_vars.PROJECT,
    262         os.environ.get(environment_vars.LEGACY_PROJECT))
    263
    264     checkers = (
    265         _get_explicit_environ_credentials,
    266         _get_gcloud_sdk_credentials,
    267         _get_gae_credentials,
    268         lambda: _get_gce_credentials(request))
    269
    270     for checker in checkers:
    271         credentials, project_id = checker()
# credentials are always none if there are no credentials in environment...
    272         if credentials is not None:
    273             credentials = with_scopes_if_required(credentials, scopes)
# ...so this line is never reached, and explicit_project_id isn't used
    274             effective_project_id = explicit_project_id or project_id
    275             if not effective_project_id:
    276                 _LOGGER.warning(
    277                     'No project ID could be determined. Consider running '
    278                     '`gcloud config set project` or setting the %s '
    279                     'environment variable',
    280                     environment_vars.PROJECT)
    281             return credentials, effective_project_id
    282
--> 283     raise exceptions.DefaultCredentialsError(_HELP_MESSAGE)

Is this intended? We can pull GOOGLE_CLOUD_PROJECT manually and pass that in, though the auto-fallback to the env var is a bit of convenience

[theacodes]

Correct, this is entirely intentional. See https://diogomonica.com/2017/03/27/why-you-shouldnt-use-env-variables-for-secret-data/

[max-sixty]

Thank you! That def resonates